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I. INTRODUCTION 



Any member of this family can be expressed as 



Some interesting applications of the iV-particle iV-level 
singlet states have been recently introduced pj. Partic- 
ularly, the three three-level singlet state 
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(the lower and upper indexes refer, respectively, to the 
number of constituents and the dimension of the Hilbcrt 
space of any of the constituents of the composite sys- 
tem) was shown to be useful for solving the "liar detec- 
tion problem" ,1], which is a simplification of a classi- 
cally unsolvable problem in quantum computing called 
the "Byzantine generals' problem" or the "Byzantine 
agreement problem" introduced in two seminal papers 
by Lamport, Pease, and Shostak 0,0, and inspired by 
a pseudohistorical scenario Q . A version of this problem 
was previously solved by Fitzi, Gisin, and Maurer [f| also 
using the three three-level singlet state. Ref. ended 
by remarking that the preparation of the required states 
would pose a formidable challenge. Meanwhile, Gisin has 
proposed a method for preparing the three three-level sin- 
glet state 0. To my knowledge, no experimental results 
have as yet been reported. 

On the other hand, the Munich group Q (see also 
Ref. Q) has prepared, using parametric down-converted 
photons entangled in polarization, a four-qubit entangled 
state that can be expressed as 
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This state belongs to a family of states of N (even) qubits 
that generalizes the familiar two-qubit singlet state 
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where the sum is extended to all of the states obtained 
by permuting the state |0 ... 01 ... 1), which contains the 
same number of 0's and l's; z is the number of 0's in 
the first N/2 positions (for example, in |01), z = 1; in 
|1100), z = 0; in |010110), z = 2V Expression © is 
similar to that introduced in Ref. |l| for the Af-particle 
TV-level singlet states (which, according to the notation 
introduced here, should be denoted as |sjy^)). 

The interesting point is that the iV-qubit "singlet" 
states given by Eq. © share some properties with the 
A^-particle N- level singlet states introduced in Ref. 
Both are nonseparable and A^-lateral unitary invariant. 
Nonseparability means that no local model can mimic 
the predictions of quantum mechanics for these states 
|lfjj] and implies that the outcomes of the measurements 
do not reveal predefined results. A^-lateral unitary invari- 
ance means that, if we act on any state with the tensor 
product of N equal unitary operators, the result will be 
to reproduce the same state: 
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being U <g> . . . <g> U, where U is a unitary oper- 
ator. This implies that the same correlations between 
the outcomes of measurements on the N particles occur 
for different sets of measurements. Both properties were 
essential to the solutions to the problems proposed in 
Refs. 0, 0. The question is whether the |S*?) states 
can be used to perform tasks that, so far, were specific 



to the |<S 



N 



states. 
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The \S^'} states can be used to distribute crypto- 
graphic keys [ill ll^ . encode quantum information in 
decoherence-free subspaces 0, 0, 0] , perform se- 
cret sharing, and teleclone quantum states (telecloning 
is a process combining quantum telcportation and opti- 
mal quantum cloning from 1 input to M outputs) p"?| . In 

(2) 

fact, for N > 4, the \S N ) states are the AT-lateral unitary 
invariant version of the telecloning states introduced in 
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Ref. 01 • -"- n this paper, I shall show that the state IS^) 
can also be used to solve the Byzantine generals' and liar 
detection problems. 

The Byzantine generals ' problem is a classical problem 
in distributed computing defined as follows. N generals 
are connected by secure pair wise classical channels. A 
commanding general must send an order to his N — 1 lieu- 
tenant generals such that: (a) All loyal lieutenant gener- 
als obey the same order; (b) if the commanding general is 
loyal, then every loyal lieutenant general obeys his order. 
If the commanding general is loyal, (a) follows from (b). 
However, the commanding general may be a traitor. 

The Byzantine generals' problem is a metaphor for dis- 
tributed processes, some of which may be faulty. For 
N = 3 generals and 1 traitor the problem has no classi- 
cal solution, as proved in Refs. 0,y|. However, a version 
thereof can be solved with the aid of quantum mechanics. 
The protocol proposed in Ref. p| solves the Byzantine 
generals' problem for N = 3 in the following sense: if all 
generals are loyal then, after the protocol, all the gener- 
als would obey the commanding general's order. If one 
general is a traitor then, after the protocol, either the 
two loyal generals would obey the commanding general's 
order or abort the process. 

As can be easily seen, the Byzantine generals' prob- 
lem for N — 3 generals and 1 traitor is equivalent to the 
liar detection problem defined as follows Q: three par- 
ties A(lice), -B(ob), and C(arol) are connected by secure 
pair wise classical channels. A sends a message m to B 
and C, and B forwards the message to C. If both A and 
B are honest, then C should receive the same message 
from A and B. However, A could be dishonest and send 
different messages to B and C, ttlab ^ fnAC, or, alterna- 
tively, B could be dishonest and send a message that is 
different from that he has received, msc ^ mAB- For C 
the problem is to ascertain without a shadow of a doubt 
who is being dishonest. 

In Sec. IIIII I shall introduce a protocol based on 
the |<f>4 ) state for solving the liar detection problem 
(and thus also the Byzantine generals' problem) in the 
following sense: if both A and B are honest then C will 
receive the same message from A and B. If one of A and 
B is dishonest then, after the protocol, either C ascertain 
who is being dishonest or C does not accept the message 
from one of the parties A and B. 

Before getting into the details of the protocol, it would 
be useful to give a rough idea of how it works: besides 
their messages, A and B must send some additional infor- 
mation. For instance, A must also send B some private 
information correlated with the message. B and C must 
be able to check the authenticity of the information they 
have received by using private information. In addition, 
to convince C that the message B is sending her is actu- 
ally that B received from A, B would also need to send C 
the information B has received from A. In this scenario, 
being a liar means that she/he did not distribute the ap- 
propriate additional information. The advantage derives 
from the fact that C can detect the origin of the inap- 



propriate information. 

II. DISTRIBUTE AND TEST PROTOCOL 

The protocol for solving the liar detection problem de- 
scribed in Sec. IIIII is based on the assumption that, at 
the beginning of the protocol, A, B, and C share a large 

(2) 

number L of four-qubit systems in the |<S| ) state de- 
scribed by Eq. J2J) such that, for each four-qubit system 
j (from 1 to L), A possesses two qubits (qubits j\ and 
j2, or qubits ji and but she does not know which 
two), B possesses one qubit (j'3 or but he does not 
know which one), and C possesses the fourth qubit j'4 
and knows which qubits A and B have in their posses- 
sion. 

The purpose of this distribute and test protocol, pre- 
ceding the protocol for liar detection, is to prepare the 
initial scenario required for the second protocol and test 
whether or not said initial scenario has been achieved. 
The distribute and test protocol has only two possi- 
ble outcomes: success or failure. In case of success, C 
would assume that the required initial scenario has been 
achieved and then the liar detection can be reliably ac- 
complished. In case of failure, C would conclude that 
something went wrong and would abort any subsequent 
action. 

The initial assumptions are that there are only three 
parties involved: A, B, and C, and that they are con- 
nected by secure pairwise classical channels and by noise- 
less quantum channels. 

The distribute and test protocol is as follows. 

(i) C prepares a large number M > L of four-qubit 
systems in the \S\ ) state. For each four-qubit system 
j (from 1 to M), C sends two qubits (qubits j\ and j'2, 
or qubits ji and j'3) to A, one qubit to B (J3 or j'2), and 
keeps the fourth qubit for herself. 

(ii) For each four-qubit system j sent, C checks 
whether or not A and B have received the right num- 
ber of qubits (two qubits for A and one for B). 

(iii) C randomly chooses two large enough subsets Si 
and S2 of the distributed four-qubit systems. These sub- 
sets are used only to test whether or not the initial sce- 
nario required for the protocol for liar detection has been 
achieved. Qubits belonging to Si and S2 will be dis- 
carded at the end of the distribute and test protocol. 
If Ni is the number of four-qubit systems in S%, then 
M = N x + N 2 + L. 

(iv) For each four-qubit system j of Si, C asks A to 
send B her two qubits. 

(v) C checks whether or not B has received A's qubits. 

(vi) C asks B to perform some measurements on each 
of the three qubits (the two qubits B has received from 
A plus the one that has been in B's possession from the 
start), and report his results to her by using the secure 
pairwise classical channel between them. For instance, C 
can ask B to perform a measurement of the spin along 
the same direction on all three qubits, Mj. 
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(vii) C performs a measurement on her corresponding 
qubit. For instance, C can measure Mj. The outcomes 
of B and C's measurements must be correlated. For in- 
stance, if they have measured Mj on the four qubits, two 
of them must be "0" and the other two must be "1" ; due 
to unitary invariance, this occurs for any Mj. Due to 
the fact that A's qubits are entangled with B and C's 
qubits, the outcomes can be proved [10( to be genuinely 
unpredictable (if one does not know the results of the 
other measurements). C checks whether the expected 
correlations occur. 

(viii) For each four-qubit system j of S2, C follows the 
same steps as in (iv)-(vii), only exchanging the roles of 
A and B. 

(ix) Since C's choice of subsets Si and Sz is known 
by A and B only after all qubits have been distributed 
among them, then, if all the outcomes are correctly corre- 
lated, C would assume that the remaining L distributed 
four-qubit systems are in the \S\ ) state and use them for 
the protocol described below. If not, C would conclude 
that something went wrong and abort any subsequent 
action. 

III. PROTOCOL FOR LIAR DETECTION 

Let us suppose that the message m that A sends to B 
and C, and B sends to C is a bit value "0" or "1" and 
that all three parties agree to use the following protocol. 

(I) For each four-qubit system, C asks A and B to per- 
form the same measurement on their individual qubits. 
After a large number of these measurements, both B and 
C (A) are in possession of a long list of (pairs of) 0's and 
l's Ib, and lc {I a) such as the following. 



Position I a Ib lc 

1 00 1 1 

2 01 1 

3 00 1 1 

4 11 

5 11 

6 00 1 1 

7 01 1 

8 11 



Each of these lists has the following properties. 

(a) It is random (i.e., generated by an intrinsically un- 
repeatable method that gives each possible number the 
same probability of occurring) . 

(b) It is correlated to the other two lists. If "00" ("11") 
is in position j in I a, then "1" ("0") is in position j in 
Ib and lc- 

(c) Each party knows only his/her own list. 

(II) The message A sends B is denoted as tuab- In 
addition to tuab, A must also send B the list l A mAB ^ 1 of 



positions in I a in which tuab appears twice. For instance, 
if A sends B the message tuab — 0, then she must also 
send B the list l^ AB =^ = {1, 3, 6, . . .} since, in l A , "00" 
appears in positions 1,3,6,... Note that, if the sequences 
are random and long enough, then the length of l < A mAB ~ ^ 
must be about one-quarter of the total length L of the 
list I a- 

(III) B would not accept the message if the re- 
ceived list is not compatible with Ib or the 
length of l A mAB) < L/4. For instance, if l^ AB =^ = 
{1, 2, 3, 6, . . .}, then B would not accept the message be- 
cause "0" is in position 2 in Ib, so A cannot have "00" 
in this position. 

Requirements (II) and (III) force A to send B infor- 
mation which is correct but perhaps incomplete. Other- 
wise, if A sends a list containing n erroneous data, then 
the probability that B does not accept the message rriAB 
would be at last (2" - l)/2™. 

(IV) The message B sends C is denoted as tubc- B 
must also send C a list f™ 30 ^, which is supposedly the 
same l A mAB * > that B has received from A. 

(V) The message A sends C is denoted as tuac- A 
must also send C a list Iac, which is supposedly I a- 

(VI) When C finds that tuac 7^ msc, she has three 
lists lc, ^ nBC \ and Iac, to help her find out whether 
it is A or B who is being dishonest. C must first check 
whether Iac is consistent with lc- If not, then A is the 
liar. If yes, then C must check whether l^™ 30 ^ has an ap- 
propriate length and is consistent with Iac- If n ot, then 
B is the liar. At this stage, this is the only possibility. 



IV. CONCLUSIONS 

The main practical advantage of the introduced proto- 
col over those presented in Refs. pi Q is that it requires 
a simpler quantum state (a four-qubit state instead of 
a three-qutrit state) which has been already prepared 
in a laboratory Q. This would make the new protocol 
immediately applicable for solving both the Byzantine 
generals' and liar detection problems. The main theoret- 
ical advantage is that the introduced protocol seems to be 
fundamental in a greater degree than those in Refs. PJ0j 
in the sense that it requires that only one party uses trit 
values, instead of all three parties. 

Although both the Byzantine generals' and liar detec- 
tion problems assume that the parties are connected by 
secure pairwise classical channels (secure messengers in 
Ref. U), this is an unrealistic constraint for real applica- 
tions. Note, however, that the protocol described above 
also works if the classical channels between A and C, and 
between B and C are not secure but public and unjam- 
able (i.e., which cannot be tampered with). Obviously, 
such a channel cannot be used to distribute delicate in- 
formation (like, for instance, whether or not the gener- 
als will attack, or the lists l^™ 30 ^ and Iac), but can be 
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used, together with an additional quantum channel, to 
implement a standard quantum key distribution proto- 
col [Til ll2T | to send this delicate information. The final 
picture gives us a quantum solution to a problem with- 
out classical solution: the liar detection problem without 
secure classical channels. 
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